high2026-10-13SAP Commerce CloudCVE-2026-89113
SQL Injection in SAP Commerce Cloud
SAP Commerce Cloud
Our Take
Internet-facing storefront plus SQL injection is not a combination to leave for the quarterly window. The workaround costs you sorting, which beats costing you the customer table.
Vulnerability Detail
An SQL injection flaw in a request parameter. A temporary mitigation is to disable the affected parameter, at the cost of the sorting functionality.
Patch Action
Apply SAP Note 3800517. Disabling the affected parameter is a stop-gap if you need time; expect sorting to stop working.
Affected Versions
COM_CLOUD 2211-JDK21
Patch Info